Re: [gentoo-hardened] SELinux base policy r2 in hardened-dev overlay

[Radosław Smogura]

Sven Vermeulen <swift@g.o> Monday 22 of August 2011 19:11:38
> On Mon, Aug 22, 2011 at 03:18:16PM +0000, Sven Vermeulen wrote:
> > What you are suggesting (label init script) is exactly what I was talking
> > about: instead of having the init scripts labeled initrc_exec_t, they
> > should be labeled like slapd_initrc_exec_t, postfix_initrc_exec_t, ...
> > and Gentoo's integrated run_init support, which by the policy is
> > currently only working on initrc_exec_t, should support those too.
>
> I guess that won't be happening soon.
>
> When an administrative interface is granted to a domain/role (like
> ldap_admin) then a role transition to system_r is automatically granted
> when a transition occurs on the domain-specific initrc script (like
> slapd_initrc_exec_t). In case of integrated run_init support, this would
> create a context root:system_r:run_init_t, which is invalid.
>
> Removing the role transition in all administrative interfaces is imo a
> no-go as that would mean lots of work and maintenance.
>
> Oh well, it was fun to try...
>
> Wkr,
> 	Sven Vermeulen
Maybe better idea will be to move one level upper and instead of working with 
domain templates we should create role templates. I generally like idea of 
roles, and I think it may be nice solution that administrator may give someone 
dba_admin role.

So templates should not only create domains, but roles too.

I may try to write few such templates.

Regards,
Radek